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Re: Final Appellate Determination Denying FOIA Appeal No. 2019-432 

Dear Mr. Amarel: 

This letter constitutes the final deter min ation of the Consumer Financial Protection Bureau 
regarding your appeal of the Bureau’s response to Freedom of Information Act (FOIA) Request 
CFPB-2019-423-F (the Request).' For the reasons set forth below, the appeal is denied. 

I, Background 

On July 16, 2019, the Bureau received the Request seeking: 

“[CJopies of the past 50 emails sent to, from, or copied to 
whistleblower@cfpb.gov containing the non-case-sensitive key-strings: 

'FB-5".” 


' The Bureau’s FOIA regulations are codified at 12 C.F.R. §§ 1070.10 et seq. Pursuant to these 
regulations, the authority to determine FOIA appeals rests with the Bureau’s General Counsel or 
her delegate. See 12 C.F.R. § 1070.21(e). The General Counsel has delegated to me the authority 
to determine the appeal of the Bureau’s response to the Request. This letter therefore constitutes 
the Bureau’s final response to the Request. 
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On July 23, 2019, the Bureau transmitted its response to the Request (the Response). The 
Response provides that the Bureau can neither confirm nor deny the existence of records 
responsive to the Request. On August 14, 2019 you filed this appeal challenging the failure to 
produce responsive records and requesting specific information regarding the number of pages 
identified, the “full FOIA log,” and “an index of exemptions for the records.” 

II, Appellate Determination 

The Request sought information provided to the Bureau’s electronic mailbox for 
whistleblower communications. CFPB Bulletin 2011-05 provides guidance to the public on the 
Bureau’s whistleblower program. The Bulletin solicits information from sources with 
knowledge about potential violations of federal consumer financial laws. It welcomes 
whistleblower information and other law enforcement tips “from current or former employees of 
potential violators, contractors, vendors, and competitor companies.” The Bulletin further 
recognizes the need of some whistleblowers to provide their information anonymously and 
allows for the anonymous transmission of information by email to whistlebl 0 wer@cfpb. 5 qy. 

And the Bulletin assures those who make anonymous submissions that “[t]o the extent consistent 
with law enforcement needs the Bureau will not disclose your identifying information and will 
maintain your confidentiality as permitted by federal laws such as the Privacy Act, the Freedom 
of Information Act and any applicable Bureau regulation.” See CFPB Bulletin 2011-05 
(Enforcement and Fair Lending), Dec. 15, 2011, available at 
http?i(/fi!es.cqnsumerfinance. 5 qy/f/ 2011 / 12 /CFPB_Enforcement_Bulletin _12 

The Bureau relied on Exemption 7 to withhold all responsive records. Exemption 7(C) 
allows an agency to withhold material that was compiled for law enforcement purposes when 
disclosure of that material “could reasonably be expected to constitute an unwarranted invasion 
of personal privacy.” 5 U.S.C. § 552(b)(7)(C). Applying Exemption 7(C), the Supreme Court 
found that a third-party’s request for law enforcement records pertaining to a private citizen 
categorically invades that citizen’s privacy. See DOJv. Reporters Comm, for Freedom of the 
Press, 489 U.S. 749, 777 (1989). And where the third-party’s request seeks no official 
information about the federal agency, the privacy invasion is unwarranted. Id. 

Under this framework. Exemption 7(C) applies to protect from disclosure the emails that you 
requested. The threshold requirement of Exemption 7(C) is met because the requested emails are 
law enforcement records that were compiled for law enforcement purposes. See Rural Housing 
Authority Alliance V. U.S. Dept, of Agriculture, 498 E.2d. 73, 80-83 (D.C. Cir. 1974). Moreover, 
because your Request did not seek information about the operation of the Bureau, disclosure of 
the requested emails is an unwarranted invasion of the privacy of any potential whistleblower 
who transmitted information to the Bureau’s whistleblqwer@cfpb. 5 qy inbox. Exemption 7(C) 
applies to protect the identity of individuals who provide information to a law enforcement 
agency about potential violations of law. McCutchenv. U.S. Dept, of Health and Human Svs., 

30 E.3d 183, 189 (D.C. Cir. 1994) (“complainants have a strong privacy interest in remaining 
anonymous because, as ‘whistle-blowers,’ they might face retaliation if their identities were 
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revealed”). And, where Exemption 7(C) applies to protect an individual’s identity from 
disclosure, all personally identifiable information about the individual may be withheld. See 
Nat’I Whistleblower Ctr. v. U.S. Dept, of Health and Human ^v^., 849 F. Supp. 2d 13, 30 
(D.D.C. 2012); Sorin v. U.S. Dept. ofJustice,2%0 F. Supp. 3d 550, 564 (D.D.C. 2017). 

In addition, the Bureau’s Response to your Request appropriately refused to confirm or deny 
the existence of emails to, from or copied to the whistleblower@cfpb. 50 y inbox containing the 
keyword “EB-5”. FOIA’s “exemptions cover not only the content of protected records but also 
the fact of their existence or nonexistence, if that fact itself properly falls wit hin the exemption.” 
Larson v. Dep 'tof State, 565 F.3d 857, 861 (D.C. Cir. 2009). An agency may, therefore, “refuse 
to confirm or deny the existence of records where to answer the FOIA inquiry would cause harm 
cognizable under a [] FOIA exception.” Wolfv. CIA, 473 F.3d 370, 374 (D.C. Cir. 2007) 
(internal quotation marks and citation omitted). In other words, such a response is appropriate 
where an agency’s confirmation of the existence of a record would cause the very harm that a 
specific exemption is intended to prevent. If the Bureau were to deny the existence of law 
enforcement records pertaining to a particular person or company when it could do so, then that 
would indicate that a response like this one - that the Bureau can neither confirm nor deny the 
existence of responsive records - was in fact a statement that records pertaining to the person do 
exist. This “Glomar” response is, accordingly, appropriate. 

Because disclosure of the existence of the requested emails would have confirmed that 
information regarding the requested keyword was transmitted to the Bureau’s whistleblower 
mailbox, the Bureau appropriately refuse to confirm or deny the existence such emails. 

For the foregoing reasons, the appeal is denied. 

If you are dissatisfied with the Bureau’s final appellate determination, you may contact the 
Office of Government Information Services (OGIS), which offers mediation services to resolve 
disputes between FOIA requesters and Federal agencies pursuant to 5 U.S.C. § 552(h)(3). Using 
OGIS services does not affect your right to pursue litigation. Under 5 U.S.C. § 552(a)(4)(B), 
you may also seek judicial review of this appeal denial in the U.S. District Court where you 
reside, in the district where the documents are located, or in the District of Columbia. 

V Digitally signed by 
OLCVCM I . Steven Y. Bressler 

Date: 2019.09.11 
16:39:51 -04'00' 

Steven Y. Bressler 
Assistant General Counsel for 
Fitigation and Oversight 
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